CVE-2026-120741 Details
Description
The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permission_callback => '__return_true' and the handler's 'name' parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb->insert, nor is it escaped on output in the admin bookings list when the viewing user lacks the 'mpa_edit_customer' capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A stored cross-site scripting vulnerability has been identified in the MotoPress Appointment Booking Lite plugin for WordPress, affecting versions through 2.4.8. The issue arises in the public '/motopress/appointment/v1/customers/create' REST endpoint, which is accessible without authentication. The endpoint's 'name' parameter is not properly sanitized before being saved to the wp_mpa_customers table, nor is it escaped when displayed in the admin bookings list for users without the 'mpa_edit_customer' capability, such as those assigned the Appointment Employee role. This oversight allows unauthenticated attackers to inject malicious scripts that are executed when a user views the affected page.
Users are advised to update the MotoPress Appointment Booking Lite plugin to version 2.4.9 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 7, 2026CISA-ADP
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MotoPress Appointment Booking Lite | <= 2.4.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | CVE Modified | CISA-ADP |
| Nov 7, 2026 | New CVE Received | [email protected] |